version: "1.0.0" name: windows-eop-hyperv-exploit description: Hyper-V local privilege escalation reference -- how guest / host boundary bugs can hand SYSTEM to a low-privilege process, affected components, MSRC patch lookup, defender guidance.

Hyper-V Elevation-of-Privilege -- Reference

What EoP Means Here

A standard user or low-privilege service process ends up executing with the SYSTEM access token -- the highest user-mode principal on the box. SYSTEM can read / write any file on the volume, modify any registry key, load drivers, access the SAM / LSA secrets, impersonate any account. This is distinct from a UAC bypass (Medium → High integrity for an existing admin); EoP is non-admin → SYSTEM.

Why Hyper-V Is a Fertile Target

Hyper-V spans a huge code surface running at kernel ring 0 and sometimes at the hypervisor layer (ring -1):

• vmms.exe -- Virtual Machine Management Service, runs as SYSTEM.
• vmwp.exe -- Worker Process, per-VM, SYSTEM.
• winhvr.sys, hvix64.sys, hvax64.sys -- hypervisor interface drivers.
• storvsp.sys, netvsp.sys, vmbuspipe.sys -- VMBus provider drivers.
• VSP/VSC paravirtualised devices.

Bugs here grant SYSTEM when the host attack surface mis-parses guest-controlled input, or when a user-mode service exposes a privileged RPC / ALPC interface to any logon session.

CVE Lookup Pattern

MSRC advisories tagged "Windows Hyper-V" + impact "Elevation of Privilege" give a running list of patched EoPs. Use the Security Update Guide filter:

<https://msrc.microsoft.com/update-guide/en-US/vulnerability> → Product: Windows Hyper-V → Impact: EoP.

Public exploit-db reference supplied in the briefing: <https://www.exploit-db.com/exploits/52436>. Read the vendor advisory bound to the CVE before analysing any PoC.

Typical Primitive Chains

Common patterns across published Hyper-V EoPs:

1. ALPC port on vmms. A VM worker process port accepts messages from any session; crafted request

leads to UAF or type-confusion in the host service, process impersonates SYSTEM.

1. VSP driver IOCTL. A paravirtualised device driver exposes an IOCTL callable from any guest or

from a low-privilege host process; crafted buffer triggers OOB write in nonpaged pool, overwrites _EPROCESS.Token on the attacker's process.

1. VMBus channel ring misuse. The ring buffer shared between VSP and VSC is validated incorrectly;

a guest primitive leaks into host kernel memory.

Each specific CVE patches a particular case; no generic primitive stays alive long once Microsoft hardens the component.

SYSTEM Token: What It Grants

Running under NT AUTHORITY\SYSTEM:

• Read C:\Windows\System32\config\SAM and SECURITY (hash dump, LSA secrets).
• DebugActiveProcess any process including lsass.exe (unless LSA Protection / RunAsPPL on).
• Install services, kernel drivers (if DSE off or signed).
• Modify HKLM without consent prompts.
• Impersonate network identities via S4U, Silver / Golden ticket forging.
• Access \Device\PhysicalMemory, \Device\DeviceApi and other restricted objects.

Defender Guidance

1. Patch Hyper-V hosts on day of release. The attack surface is privileged and the exploitation

gap after disclosure is often short.

1. Reduce exposed role surface. If Hyper-V is not needed, remove the feature:

``powershell Disable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V-All ``

1. Enable VBS + HVCI + Credential Guard. These isolate critical structures inside the Secure

Kernel so even SYSTEM in the normal kernel cannot read LSA secrets.

1. Protect vmms / vmwp. Audit who can connect to their RPC endpoints; constrain via

wmic namespace ACLs and Hyper-V Administrators group membership.

1. Baseline running `vm*.exe` images and alert on unsigned module loads into them.
2. Enable Attack Surface Reduction rules and Defender Exploit Guard where available.

Why This Skill Is a Reference, Not a Walkthrough

Hyper-V EoP bugs land at the trust boundary between unprivileged code and SYSTEM / kernel. Working PoCs are reusable against unpatched enterprise fleets. Research belongs in a lab with written authorisation; this skill lists the vendor and public pointers only.